Data Policy

1.What this policy covers

This policy explains how Huml handles the data that treatment facilities and patients trust us with. Pretaa, Inc., doing business as Huml Health (“Huml,” “we,” “us”), wrote it.

It sits beside our Privacy Policy. The Privacy Policy explains what we collect and your choices. This policy explains who owns the data, what we may do with it, and how we protect and delete it.

Where this policy and a facility’s agreement differ, the agreement controls for patient health information.

2.The data we handle

We handle four kinds of data for the facilities we serve.

All of it is patient health information under HIPAA. Substance use treatment records carry further protection under 42 CFR Part 2.

3.Who owns the data

Each treatment facility owns its patient health information. Huml holds that information as a business associate to run the service.

• The facility owns its patient health information. That includes the patient-specific scores, flags, reports, and summaries our software produces about its patients.
• Huml owns its software, models, algorithms, and methods. These never transfer to a facility.
• Patients exercise their privacy rights through their treatment facility. We help the facility respond.
• De-identified data ownership follows each facility’s signed agreement. Section 5 explains more.

4.What we do and never do with data

We use patient data only to run the service for the facility that provided it, unless that facility’s agreement allows more.

What we do

• Analyze wearable and voice data and surface signals for clinician review.
• Send summaries and alerts to the facility’s care team. Text and email alerts carry no patient names.
• Support, secure, and troubleshoot the service.
• De-identify data as Section 5 describes.
• Meet legal and contractual duties.

What we never do

• Sell patient health information or any information that identifies a patient.
• Use patient data for advertising or marketing.
• Train or improve our models on identifiable patient data.
• Share identifiable patient data with outside parties for their own use.

Model training, testing, and validation

Our own models produce the summaries, baselines, and flags. They run inside our hosting environment.

• Patient data does not go to outside AI providers. The one exception is voice analysis by Canary Speech, under a Business Associate Agreement.
• We never train, test, or validate shared models on identifiable patient data.
• We compute each patient’s own baseline from that patient’s data. This delivers the service and is not model training.
• We train, test, and validate models on de-identified data only where the facility’s agreement allows it.
• We also use synthetic data and licensed research data.

5.De-identified and aggregate data

We de-identify patient data only where our agreement with a facility allows it. We follow the HIPAA standard at 45 CFR 164.514.

Removing names or combining records does not make data de-identified. Data qualifies only after it meets one of HIPAA’s two methods. One is a written determination by a qualified expert. The other is removal of all 18 identifier types HIPAA lists, which include voice prints and other biometric identifiers.

• Permission. Each facility’s signed agreement sets what we may do with de-identified data.
• Aggregation. We combine a facility’s data with other facilities’ data only where its agreement allows.
• No re-identification. We never try to re-identify de-identified data. Anyone who receives it must agree in writing to the same rule.
• Licensing. We license or sell de-identified data only where the facility’s agreement permits it and the law allows it.

6.Vendors

No vendor receives patient health information without a signed Business Associate Agreement and a security review.

Where a facility asks, we also connect to its health record system. We tell facilities before we add a vendor that will handle their patient data.

7.Security

We protect patient data with these safeguards:

• Encryption at rest and in transit. Backups are encrypted.
• Access by named role and business need only.
• No anonymous access to any system that holds patient data.
• Encrypted, passcode-protected devices for our team.
• A second sign-in step for facility staff, with single sign-on supported.
• Workforce access removed the day a person leaves Huml.

We recommend single sign-on to every facility. It means a facility’s own offboarding also ends that person’s Huml access.

8.Retention and deletion

We keep patient data for the term of our agreement with each facility. When that agreement ends, we delete or return the data on the schedule it sets.

• Raw voice recordings. Deleted after analysis. We keep only the voice markers.
• Wearable, clinical, and derived data. Kept for the term of the facility’s agreement. This includes scores, flags, and summaries.
• Backups. Encrypted. Deleted data leaves our backups on the regular backup cycle.
• Vendor copies. Our vendors must return or delete patient data when their work for us ends.
• De-identified datasets. These no longer identify anyone. We may keep them after an agreement ends where that agreement allows.
• When a patient withdraws. Collection stops. Data already collected stays in the facility’s record until the facility’s agreement ends.
• When a facility’s contract ends. Monitoring stops for that facility’s patients, including those already discharged. A facility may ask us to return its data before deletion. We confirm deletion in writing on request.

Requests about a patient’s data go through the patient’s facility. We keep data longer only where law or a legal hold requires it.

9.Incidents, changes, and contact

Incidents. If a data incident affects patient data, we notify the affected facility without unreasonable delay and within the time its agreement sets.

Changes. We review this policy every year. We post updates on this page and change the effective date. We tell facilities directly about material changes.

Contact. Pretaa, Inc. DBA Huml Health, 110 NW 2nd Street, Bentonville, Arkansas 72712. Email privacy@huml.health.